AI Agent Sandboxes

Executive Summary

A new infrastructure category has emerged: sandbox platforms for AI agent code execution. These platforms solve the problem of "where should AI-generated code run?" with isolated, secure environments that agents can use to execute arbitrary code.

Market Leaders (7 platforms): E2B, Sprites, Daytona, Modal, Quilt, Runloop, CodeSandbox SDK

Key Findings:

• E2B dominates with 200M+ sandboxes started and Fortune 100 adoption
• Sprites (Fly.io) challenges the ephemeral model with persistent VMs and instant checkpoint/restore
• Daytona offers the fastest creation (90ms) and unique Computer Use support
• Modal leads for GPU workloads with serverless Python infrastructure
• The market is splitting into ephemeral (security-first) vs persistent (productivity-first) camps

Strategic Planning Assumptions:

• By 2027, checkpoint/restore will become table stakes across all platforms
• By 2028, Computer Use (browser/desktop) will be a standard feature, not a differentiator

---

Market Definition

AI agent sandboxes are isolated execution environments designed for running AI-generated or arbitrary code safely. They provide:

• Isolation — Code runs in VMs or containers, separated from host systems
• APIs/SDKs — Programmatic creation and management
• Security — Protection against malicious or buggy code
• Scalability — Ability to run thousands of concurrent sandboxes

Key distinction from cloud compute: These are purpose-built for agent use cases, not general application hosting. They optimize for fast creation, easy cleanup, and developer-friendly SDKs.

---

Comparison Matrix

Platform	Model	Creation	Persist	Checkpoints	GPU	Isolation
CodeSandbox	Persistent	~2s	✅	✅	❌	microVMs
Daytona	Persistent	90ms	✅	❌	❌	Docker
E2B	Ephemeral	~150ms	❌	❌	❌	Firecracker
Modal	Serverless	~2s	❌	❌	✅	gVisor
Quilt	Ephemeral	~200ms	❌	❌	❌	Namespaces
Runloop	Persistent	~2s	✅	✅	❌	Custom
Sprites	Persistent	1-2s	✅	✅	❌	Firecracker
Vercel AI Gateway	API Proxy	N/A	N/A	N/A	❌	N/A

Daytona also supports Computer Use (Linux/Windows/macOS virtual desktops). Vercel AI Gateway is an API proxy, not an execution sandbox — included for infrastructure completeness.

---

Product Profiles

E2B

The market leader for ephemeral AI sandboxes.^[1] Open-source, Firecracker VMs, used by 88% of Fortune 100.

• 200M+ sandboxes started, 1M+ monthly SDK downloads
• Firecracker microVMs (same tech as AWS Lambda)
• Custom templates for pre-configured environments
• Python, JavaScript, Go SDKs
• ⚠️ Ephemeral only — state destroyed after each session

Best for: Stateless code execution, security-sensitive workloads, high-volume eval pipelines.

Pricing: Free tier available. Usage-based billing.

---

Sprites

Persistent VMs with instant checkpoint/restore.^[2] Fly.io's answer to ephemeral sandbox limitations.

• 100GB persistent ext4 filesystem, backed by object storage
• Checkpoint/restore in ~1 second (like git for the whole system)
• Auto-sleep when idle, wake on demand — no charges when sleeping
• Firecracker VMs with hardware-level isolation
• ⚠️ New product, ecosystem still maturing

Best for: Agents that need state between runs, experimentation with checkpoint/rollback, long-running dev environments.

Pricing: $0.07/CPU-hour, $0.04375/GB-hour memory. ~$0.44 for 4-hour Claude Code session. $30 trial credits.^[2]

---

Daytona

Fastest creation (90ms) with Computer Use support.^[3] Open-source, supports Linux/Windows/macOS virtual desktops.

• Sub-90ms sandbox creation
• Computer Use sandboxes — control virtual desktops programmatically
• File, Git, LSP, and Execute APIs
• SSH access, VS Code browser, web terminal for debugging
• Open-source with self-hosting option
• ⚠️ Docker-based isolation (less secure than Firecracker)

Best for: Browser automation agents, Computer Use workloads, teams wanting open-source/self-hosted.

Pricing: Free tier. Usage-based for cloud.

---

Modal

Serverless Python with elastic GPU scaling.^[4] Built for ML/AI workloads, not just code execution.

• Sub-second cold starts, instant autoscaling
• GPU access (NVIDIA A100, H100) without quotas
• Define infrastructure in Python code (no YAML)
• Distributed filesystem for model loading
• ⚠️ Python-centric, less suitable for polyglot agents

Best for: GPU workloads, ML inference, training jobs, Python-native teams.

Pricing: $30/month free credits. Per-second billing for CPU, GPU, memory.

---

Quilt

Open-source container infrastructure with inter-container communication.^[5] Self-hostable, built in Rust on Linux namespaces.

• ~200ms container creation
• Inter-container communication (ICC) for networking between containers
• Linux namespaces + cgroups isolation (lighter than Firecracker)
• TypeScript SDK for agent integration
• MIT/Apache-2.0 dual licensing, fully self-hostable
• ⚠️ Weaker isolation than Firecracker; early-stage product

Best for: Multi-container agent architectures, self-hosting, teams needing container networking.

Pricing: Open-source (self-hosted). Cloud offering in development.

---

Runloop

Devboxes with git-style state management.^[6] Snapshot and branch from disk state.

• 2x faster vCPUs on custom bare-metal hypervisor
• 100ms command execution
• Snapshot and branch disk state (like git for sandboxes)
• Built-in SWE-bench integration for agent evaluation
• Repo connections with automatic environment inference
• ⚠️ Focused on agent benchmarking, less general-purpose

Best for: Agent development, SWE-bench evals, teams needing reproducible environments.

Pricing: Contact for pricing. Free trial available.

---

CodeSandbox SDK

Sandbox API with forking and snapshots.^[7] From the popular browser IDE company (now owned by Together AI).

• Programmatic sandbox creation via SDK
• Forking mechanism for A/B testing agents
• Snapshots and hibernation
• Resume development after inactivity
• ⚠️ Acquired by Together AI; product direction may shift

Best for: Teams already using CodeSandbox, web development agents, educational platforms.

Pricing: Free tier. Usage-based for scale.

---

Vercel AI Gateway

Unified API proxy for 100s of AI models with budget controls and fallbacks.

• Single API key accesses OpenAI, Anthropic, Google, xAI, and more
• No markup on tokens — provider list prices
• Automatic retries and fallbacks across providers
• Built-in observability (traces, spend, latency)
• BYOK (Bring Your Own Key) support
• Sub-20ms routing latency

Best for: Teams using Vercel who want unified multi-provider access without managing infrastructure.

Pricing: $5/month free credit. Provider list prices for tokens (no markup).

Note: Vercel AI Gateway is an API proxy, not an execution sandbox. Included here as agent infrastructure.

---

Architecture Patterns

Isolation Technologies

Technology	Used By	Security Level	Performance
Firecracker	E2B, Sprites	⭐⭐⭐ Hardware-level	Fast
gVisor	Modal	⭐⭐ Kernel-level	Very Fast
Docker	Daytona	⭐ Container-level	Fastest
Namespaces	Quilt	⭐ Kernel-level	Very Fast
Custom Hypervisor	Runloop	⭐⭐⭐ Hardware-level	Fast
microVMs	CodeSandbox	⭐⭐⭐ Hardware-level	Fast

Firecracker (used by E2B, Sprites) provides the strongest isolation — the same technology AWS uses for Lambda. Each sandbox is a true microVM with its own kernel.

Ephemeral vs Persistent

The market is splitting into two philosophical camps:^[8]

Ephemeral (E2B model):

• Fresh environment every time
• Maximum security (no state leakage)
• Simpler mental model
• Must rebuild environment each session

Persistent (Sprites model):

• State survives between runs
• No rebuilding node_modules/packages
• Checkpoint/restore for experimentation
• Risk of state pollution

Fly.io argues that "ephemeral sandboxes are obsolete" for AI agents — Claude doesn't want a stateless container, it wants a computer.^[8] E2B would counter that ephemerality is a feature, not a bug, for security-sensitive enterprise deployments.

---

Enterprise Feature Comparison

Feature	CodeSandbox	Daytona	E2B	Modal	Quilt	Runloop	Sprites
SOC2	✅	✅	✅	✅	❌	❓	✅ (Fly.io)
Self-hosting	❌	✅	✅	❌	✅	❓	❌
Open source	❌	✅	✅	❌	✅	❌	❌
Custom templates	✅	✅	✅	✅	❌	✅	❌
Team features	✅	✅	✅	✅	❌	✅	❌
GPU	❌	❌	❌	✅	❌	❌	❌
Computer Use	❌	✅	❌	❌	❌	❌	❌
Container networking	❌	❌	❌	❌	✅	❌	❌

---

Strategic Recommendations

By Use Case

Use Case	Recommended	Runner-Up
High-security enterprise	E2B	Daytona (self-hosted)
Persistent agent state	Sprites	CodeSandbox
GPU/ML workloads	Modal	—
Browser automation	Daytona	—
Agent benchmarking (SWE-bench)	Runloop	E2B
Fastest creation time	Daytona	E2B
Checkpoint/restore	Sprites	Runloop
Open source preference	E2B	Quilt
Cost optimization (idle)	Sprites	Modal
Inter-container networking	Quilt	—

By Team Profile

Security-first enterprise team: → E2B (ephemeral, Firecracker, SOC2) or Daytona self-hosted

AI agent startup iterating fast: → Sprites (persistence saves rebuild time, checkpoints for experimentation)

ML/AI team needing GPUs: → Modal (only option with elastic GPU access)

Building Computer Use agents: → Daytona (only option with desktop automation)

Running agent evaluations: → Runloop (built-in SWE-bench) or E2B (scale)

---

Market Outlook

Near-Term (2026)

• Checkpoint/restore spreading beyond Sprites/Runloop
• E2B maintaining market share lead on ephemeral
• Daytona growing in Computer Use segment

Medium-Term (2027)

• Persistent vs ephemeral distinction blurring (both become options)
• Computer Use becoming standard feature
• GPU support expanding beyond Modal

Long-Term (2028+)

• Category may consolidate around 2-3 leaders
• Integration with agent orchestration platforms (Tembo, etc.)
• Specialized sandboxes for specific agent types

---

Bottom Line

7 platforms serve the AI agent sandbox market with distinct approaches:

Platform	Best For	Key Differentiator
CodeSandbox	Web dev agents	Forking, established ecosystem
Daytona	Computer Use and speed	90ms creation, Linux/Win/macOS desktops
E2B	Ephemeral execution at scale	200M+ sandboxes, Fortune 100 adoption
Modal	GPU workloads	Elastic GPU scaling, Python-native
Quilt	Multi-container agents	Open-source, inter-container networking
Runloop	Agent development/evals	SWE-bench integration, disk snapshots
Sprites	Persistent state with checkpoints	Object-storage durability, instant restore

The market is early and growing fast. E2B has the adoption lead, but Sprites and Daytona are pushing the boundaries on what sandboxes can do. Modal owns GPU workloads. The winners will be determined by which model — ephemeral or persistent — proves better for production AI agents.

---

Research by Ry Walker Research

Disclosure: Author is CEO of Tembo, which may integrate with sandbox platforms for agent execution.